ci-pr.yml

name: CI/CD Pipeline (PR Safe)

# This workflow mirrors ci.yml but uses pull_request instead of
# pull_request_target so it works for fork PRs without requiring
# allow-unsafe-pr-checkout.
#
# The original ci.yml uses pull_request_target which blocks fork PR
# checkouts by default for security reasons.
#
# See: https://gh.io/securely-using-pull_request_target

on:
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
  build-contracts:
    name: Build Smart Contracts
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable

      - name: Cache Cargo dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/bin/
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            contracts/target/
          key: ${{ runner.os }}-cargo-${{ hashFiles('contracts/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-

      - name: Check formatting
        run: |
          cd contracts
          cargo fmt --all -- --check

      - name: Run Clippy
        run: |
          cd contracts
          cargo clippy -- -D warnings

      - name: Build contracts
        run: |
          cd contracts
          cargo build --release

      - name: Run contract tests
        run: |
          cd contracts
          cargo test

  build-backend:
    name: Build Backend
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Verify lock file
        run: |
          if [ ! -f package-lock.json ]; then
            echo "Error: root package-lock.json is missing. Run 'npm install --package-lock-only' in the project root"
            exit 1
          fi

      - name: Install dependencies
        run: |
          npm config set fetch-retries 5
          npm config set fetch-retry-mintimeout 20000
          npm config set fetch-retry-maxtimeout 120000
          npm ci -w backend

      - name: Build backend
        run: npm run build -w backend

  build-frontend:
    name: Build Frontend
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Verify lock file
        run: |
          if [ ! -f package-lock.json ]; then
            echo "Error: root package-lock.json is missing. Run 'npm install --package-lock-only' in the project root"
            exit 1
          fi

      - name: Install dependencies
        run: |
          npm config set fetch-retries 5
          npm config set fetch-retry-mintimeout 20000
          npm config set fetch-retry-maxtimeout 120000
          npm ci -w frontend

      - name: Build frontend
        run: npm run build -w frontend
        env:
          NEXT_PUBLIC_STELLAR_RECEIVER_ADDRESS: ${{ secrets.NEXT_PUBLIC_STELLAR_RECEIVER_ADDRESS || 'GAAZI4TCR3TY5OJHCTJC2A4QSY6CJWJH5IAJTGKIN2ER7LBNVKOCCWNA' }}

  security-scan:
    name: Security Scan
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install root dependencies (for audit)
        run: npm ci --ignore-scripts

      - name: npm audit (report only, non-blocking)
        run: npm audit --audit-level=critical --workspaces --include-workspace-root || echo "npm audit found issues (non-blocking)"

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable

      - name: Cache Cargo dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/bin/
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
          key: ${{ runner.os }}-cargo-audit-${{ hashFiles('contracts/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-audit-

      - name: Install cargo-audit
        run: |
          if ! command -v cargo-audit &> /dev/null; then
            cargo install --locked cargo-audit --version 0.21.2
          fi

      - name: cargo audit (Rust dependencies, non-blocking)
        working-directory: contracts
        run: cargo audit || echo "cargo audit found issues (non-blocking)"

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-results.sarif'

      - name: Upload Trivy scan results
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: 'trivy-results.sarif'